CVE-2011-5063: The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.3...

Security readout for executives and security teams

This is an older Apache Tomcat authentication flaw. In certain Digest authentication setups, Tomcat did not properly check the realm value, so a remote attacker might bypass intended access controls if another weaker protection space was available. Exposure is most likely in legacy Tomcat deployments that still run the affected versions and use HTTP Digest Access Authentication with multiple protection spaces or inconsistent realm authorization requirements. Treat this as a legacy-platform exposure issue. It is not marked as actively exploited in the provided data, but affected Tomcat versions are obsolete and authentication bypass risk justifies timely remediation where Digest authentication is present. Mitigation focus: Upgrade Tomcat to 5.5.34, 6.0.33, 7.0.12, or later supported releases.; Apply vendor-supported Tomcat packages from Debian, Red Hat, SUSE, or another trusted distributor.; Review applications using HTTP Digest authentication for multiple realms or weaker protection spaces..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.